You have an API Management (Standard) instance using a managed gateway and plan to publish API1 whose backend database enforces a strict requests-per-minute limit. Which APIM policy should you apply to API1 to minimize the chance that requests from a specific IP address exceed the backend's per-minute limit?

The rate-limit-by-key policy is the most appropriate choice because it allows you to enforce a call rate limit based on a specific key, such as the caller's IP address (@(context.Request.IpAddress)). This directly addresses the requirement to limit requests from a specific IP address to protect the backend database. ip-filter is incorrect because it is used for allowing or denying access based on IP addresses, not for rate limiting. quota-by-key is incorrect because it enforces a total number of calls or bandwidth over a longer period (e.g., per month), not a per-minute rate limit. rate-limit is incorrect because it applies a global rate limit to all requests to the API, not a distinct limit per individual caller's IP address.